Data Processing Agreement
For business customers — May 2026
If your organisation requires a signed Data Processing Agreement (DPA) under GDPR Article 28 or comparable regulation, we'd be happy to provide one. Email support@shotdrive.io with your company name and the email of your data protection contact, and we'll send the agreement for review.
What our DPA covers
- Subject matter: file delivery via end-to-end encrypted galleries on Shotdrive.
- Duration: aligned with your subscription term plus the deletion windows in our Privacy notice.
- Categories of data subjects: your organisation's clients and recipients of shared galleries.
- Categories of personal data: gallery metadata, recipient email addresses, and any personal data contained in the file payloads you upload.
- Sub-processors: Cloudflare (hosting, storage, edge compute), Supabase (authentication and account database, EU), Brevo (transactional email, EU), Polar (merchant-of-record billing), Sentry (error monitoring), Betterstack (uptime and log monitoring).
Technical and organisational measures
End-to-end encryption (AES-256-GCM, browser-side), TLS 1.3 in transit, role-based access on internal systems, isolated staging and production environments, audit logging on privileged actions.
International transfers
Cloudflare's edge network spans multiple regions. Where data leaves the EEA, we rely on Cloudflare's standard contractual clauses and additional safeguards as documented in their public sub-processor list.